Where do viruses come from?

Viruses are never created by accident, they are always written by someone. But who is that someone, and why does he or she want to write a virus?

Most virus writers are never caught, so we have little scientific data about why they decide to write viruses. A virus writer can be of virtually any age, gender, socioeconomic group, and from any location. All that is technically required is a little computer and programming knowledge.

Writing a virus is not as difficult as one might think. This is especially true for script and macro viruses. These virus types are programmed with Visual Basic, or related, programming languages, which are designed for use by home users. When script and macro viruses spread, they travel in their source code form, which is readable by anyone who happens to get their computer infected by the virus. So basically anyone can read the code. And understand it. And modify it.

The bottom line is: anyone who knows how to program in any of the programming languages can write a new computer virus from scratch in a day. If they want to.

It seems that often a virus is created by someone who is trying to show off. They may not even intend any damage (although some do): many just want to rise to the challenge of creating something that others cannot defeat. Others like the notoriety of seeing the fear of their virus spread throughout the world. Some do it because it makes them feel important. Some do it to challenge the antivirus companies. Some do it to get on the front page of Wall Street Journal. Some do it to demonstrate vulnerabilities on current computer systems. Of course, there are also those who are truly seeking to cause massive damage or to cause undirected chaos and anarchy - worldwide.

The computer underground community and virus groups or gangs affect how new viruses are written. Virus groups are created when virus writers hook up with each other and organize themselves. These groups typically operate a web site, publish an electronic magazine - and create viruses. Most virus groups are virtual; the members are from various parts of the world and only know each other over the net. New groups are created and old ones disappear continuously. But during the active operation phase, members of a virus gang can easily generate multiple times the amount of viruses they would have created if they had been alone.

Viruses are often seen originating from countries such as USA, Russia, China, Taiwan, South Korea, Spain, India, Great Britain, Italy, the Philippines, France and the Slovak Republic - but also from countries such as Canada, Australia, Sweden, Romania, Estonia, Brazil, Japan, Singapore and the Netherlands.

Most virus writers believe that the viruses they design, develop and release do not cause ‘real’ damage to anyone. After all, most of the viruses in the world do not specifically delete data, they just spread further. However, every single virus infection causes downtime - which is the largest cause of losses generated by viruses. So every single virus out there is malicious. There is no such thing as a harmless virus. And there is no such thing as a harmless virus writer.

Mikko Hyppönen
Manager of Anti-Virus Research



Some of the active virus-writing hot spots


Begin  |  Back